TLS 1.2 is frozen: IETF deprecates RSA and FFDHE key exchange

Three new RFCs seal the TLS 1.2 era: feature freeze, deprecated key exchanges, TLS 1.3 required for new protocols. Nothing breaks for mail servers — but the direction is now official.

The IETF has formally closed the TLS 1.2 era. RFC 9851 puts TLS 1.2 under a feature freeze: apart from urgent security fixes, new TLS exporter labels and new ALPN protocol IDs, no further changes will be approved. The freeze applies to TLS — DTLS is explicitly out of scope.

At the same time, RFC 10015 deprecates two key exchange methods in (D)TLS 1.2: Diffie-Hellman over finite fields (FFDHE) and RSA key exchange. Static Elliptic Curve Diffie-Hellman is additionally marked as discouraged. The document updates seventeen older RFCs to that end — among them the TLS recommendations of RFC 9325. And RFC 9852 settles the forward direction: new protocols that use TLS must require TLS 1.3.

This matters for mail operations because SMTP is one of the largest remaining TLS 1.2 populations: opportunistic STARTTLS between MTAs still frequently negotiates TLS 1.2 in practice, because older peers offer nothing better. Nothing breaks as a result — opportunistic delivery does not fail, and TLS 1.2 itself remains defined. But the direction is now official: TLS 1.2 will not evolve further, and RSA key exchange (which lacks forward secrecy) as well as FFDHE suites are deprecated.

Concretely, operators should check that their MTA and IMAP server offer and prefer TLS 1.3 — current Postfix, Dovecot and OpenSSL versions do — and whether hand-maintained cipher lists still contain RSA key exchange or FFDHE suites. Such leftovers usually date back to compatibility configurations from years past and can typically be removed safely today. If you never pinned anything, there is usually nothing to do.

Whether your own MX still offers deprecated methods to the outside is something an external TLS check like Kuveris will show.